KR102295654B1 - Method and apparatus for predicting attack target based on attack graph - Google Patents

Abstract

The disclosed attack target prediction device includes an information extraction unit for extracting asset information including vulnerability information, network information, and application information, a data relationship setting unit for setting a correlation for the asset information, and the asset information and the correlation relationship. and an attack graph generating unit that generates an attack graph using the reachability and vulnerability determined based on the attack graph, and an attack target analysis unit that predicts an attack target based on an attack path searched based on the attack graph.

Description

Attack graph-based attack target prediction method and device therefor

The present invention relates to a method for predicting an attack target based on an attack graph and an apparatus therefor.

The content described in this section merely provides background information on the embodiments of the present invention and does not constitute the prior art.

With the recent increase in cyberattacks, companies and institutions are working to prepare for cyberattacks and to install and operate various security systems to protect corporate/institutional information assets, and to construct a safe network against cyberattacks such as hacking.

However, in the face of continuously developing cyber attacks, even security experts are not sure whether the corporate/institutional network is secure, and they do not understand all the latest vulnerabilities that are increasing exponentially, and/or unsure whether a cyberattack can occur through the route.

The Attack Graph analyzes the network environment and/or vulnerabilities of companies/institutions to solve these problems, and analyzes the attack path for an attacker to reach the core information assets of the company/organization through which route on the network. It's a way to show Through this, network administrators of enterprises/organizations can identify which parts of the network to focus on first in order to defend against cyber attacks.

Korean Patent Registration No. 10-18932530000 discloses an attack graph by analyzing the vulnerabilities of a network system for network administrators in a network environment with complex network connections and multiple vulnerabilities, and quantitative evaluation from the outside or from the inside, and optimally from the attack graph. A technique for suggesting a penetration pathway of

However, in the technique of suggesting such an optimal penetration path, the prediction result varies according to the setting of the accuracy of the penetration path prediction. Conventionally, when generating an attack graph, an attack graph is generated with a vulnerability, but the vulnerability does not include executable application-related information, so the reliability of whether an attack can be performed using an actual vulnerability is lowered.

In addition, conventionally, a relational DB (RDB) is stored for topological relationships and vulnerability information of assets, and an attack graph is generated by querying the relational DB at a time point given an attack search condition, which causes performance degradation. Accordingly, there is a need for a technology for improving the accuracy and performance of prediction of the conventional vulnerability-based cyber attack graph technology.

The task to be solved according to an embodiment is an attack graph-based attack that predicts an attack target by generating an attack graph using reachability and vulnerability determined based on asset information including vulnerability information, network information, and application information An object prediction method and an apparatus therefor are provided.

The problem to be solved is not limited to those mentioned above, and another problem to be solved that is not mentioned will be clearly understood by those of ordinary skill in the art to which the present invention belongs from the following description.

An attack target prediction apparatus according to a first aspect includes: an information extraction unit for extracting asset information including vulnerability information, network information, and application information; a data relationship setting unit for establishing a relationship with respect to the asset information; an attack graph generating unit for generating an attack graph using the reachability and vulnerability determined based on the asset information and the correlation; and an attack target analysis unit for predicting an attack target based on an attack path searched based on the attack graph.

An attack target prediction method of an attack target prediction apparatus according to a second aspect includes: an information extraction step of extracting asset information including vulnerability information, network information, and application information; a data relationship setting step of setting a correlation relationship with respect to the asset information; an attack graph generating step of generating an attack graph using the reachability and vulnerability determined based on the asset information and the correlation; and an attack target analysis step of predicting an attack target based on the attack path searched based on the attack graph.

According to an embodiment, by additionally considering information on applications executable in an asset to network information and vulnerability information, prediction accuracy of an attack target using an attack graph is improved.

In addition, by utilizing a graph DB for collecting and expressing large-scale context information for vulnerability, network and application information, the accuracy of predicting an attack target using the attack graph is further improved.

In addition, there is an effect of preventing damage to network assets on the attack path by predicting an attack target in consideration of vulnerabilities and access rights of assets through vulnerabilities, network configuration information, and application information in the attack path.

1 is a block diagram schematically showing an attack target prediction apparatus based on an attack graph according to an embodiment of the present invention.
2 is a flowchart illustrating an attack target prediction method based on an attack graph according to an embodiment of the present invention.
3 is a flowchart illustrating an operation of predicting an attack target and analyzing the risk of an attack target in the attack target prediction apparatus according to an embodiment of the present invention.
4 is a diagram for explaining an operation of processing an asset relationship graph based on network information according to an embodiment of the present invention.
5 is a diagram for explaining an operation of processing an asset relationship graph based on network information for vulnerability information and application information according to an embodiment of the present invention.
6 is a diagram for explaining an operation of generating an attack graph and predicting an attack target and a path in the attack target prediction apparatus according to an embodiment of the present invention.
7 is a diagram illustrating an analysis result of an attack target risk of an attack target prediction apparatus according to an embodiment of the present invention.
8 is a diagram for explaining a comparison between an attack target prediction method based on an attack graph according to an embodiment of the present invention and a conventional attack target prediction method.

Advantages and features of the present invention and methods of achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various forms, and only these embodiments allow the disclosure of the present invention to be complete, and those of ordinary skill in the art to which the present invention pertains. It is provided to fully inform the person of the scope of the invention, and the scope of the invention is only defined by the claims.

In describing the embodiments of the present invention, detailed descriptions of well-known functions or configurations will be omitted except when it is actually necessary to describe the embodiments of the present invention. In addition, the terms to be described later are terms defined in consideration of functions in an embodiment of the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the content throughout this specification.

Also, in this specification and claims, terms including ordinal numbers such as 'first' and 'second' may be used to distinguish between elements. This ordinal number is used to distinguish the same or similar components from each other, and the meaning of the term should not be limitedly interpreted due to the use of the ordinal number. As an example, for the components combined with such an ordinal number, the order of use or the arrangement order should not be construed as being limited by the number. If necessary, each ordinal number may be used interchangeably.

In this specification, the singular expression includes the plural expression unless the context clearly dictates otherwise. In the present application, terms such as 'comprise' or 'comprise' are intended to designate that a feature, number, step, operation, component, part, or combination thereof described in the specification is present, and one or more other It should be understood that this does not preclude the possibility of addition or presence of features or numbers, steps, operations, components, parts, or combinations thereof.

Also, in the embodiment of the present invention, when a part is connected to another part, this includes not only direct connection but also indirect connection through another medium. In addition, the meaning that a certain component includes a certain component does not exclude other components unless otherwise stated, but may further include other components.

1 is a block diagram schematically showing an attack target prediction apparatus based on an attack graph according to an embodiment of the present invention.

The attack target prediction apparatus 100 according to the present embodiment includes an information extraction unit 110 , a data relationship setting unit 120 , an attack graph generation unit 130 , and an attack target analysis unit 140 . The attack target prediction apparatus 100 of FIG. 1 is according to an embodiment, and not all blocks shown in FIG. 1 are essential components, and in another embodiment, some blocks included in the attack target prediction apparatus 100 are added. , may be changed or deleted.

The attack target prediction apparatus 100 according to the present embodiment generates an attack graph by using the vulnerability of an information system including a plurality of assets connected by a network and the information and accessibility of applications in which the vulnerability can be executed. predict the target.

The attack target prediction apparatus 100 may improve the prediction accuracy of the attack target by establishing a correlation relationship between the vulnerability information, the network information, and the application information, and generating an attack graph based on the set correlation relationship. In addition, the attack target prediction device 100 can further improve the prediction accuracy of the attack target using the attack graph by generating the attack graph using the generated asset relationship graph after generating the asset relationship graph based on the correlation relationship. have. Here, the attack target prediction device 100 is a database (hereinafter, referred to as a graph DB) of a graph structure that can process semantic queries using notes, edges, attributes, etc. in order to express and store vulnerability information, network information, and application information. ) can be used.

The attack target prediction device 100 learns the asset relationship graph using the vulnerability information, network information, and application information in advance in the graph DB, and at the point in time when the conditions for the attack target prediction are given, a path based on the asset relationship graph You can create an attack graph by exploring In addition, the attack target prediction apparatus 100 may improve the prediction accuracy of the penetration path for whether an attack is possible using an actual vulnerability by utilizing the application information of the asset.

The information extraction unit 110 performs an operation of extracting asset information for generating an attack graph. Here, the information extraction unit 110 may include a vulnerability information extraction unit 112 , a network extraction unit 114 , and an application information extraction unit 116 .

The vulnerability information extraction unit 112 extracts vulnerability information including public vulnerability information and vulnerability check result information of the asset.

The network extraction unit 114 extracts network information including the network topology of the asset, access control list information, and the like. Here, the access control list information may be ACL (Access Control List) setting information, and may include information on rights or policies related to asset access.

The application information extraction unit 116 extracts application information including executable application service information, owner account information, and authentication information from the asset. Here, the application service information may include the name and version of the application service.

On the other hand, as described in [Table 1], the information extraction unit 110 may extract various asset information to configure the attack graph. The information extraction unit 110 may utilize various databases to extract asset information. For example, National Vulnerability Database (NVD) provided by the National Institute of Standards and Technology (NIST), Open Source Vulnerability Database (OSVDB) provided by the open source camp, Common Vulnerabilities and Exposures (CVE) provided by MITER, Symantec Symantec DeepSight provided by others can be used.

The data relationship setting unit 120 stores the asset information extracted from the asset, and sets a correlation for the asset information to generate an asset relationship graph. The data relation setting unit 120 includes an asset relation graph generating unit 122 and an asset relation graph updating unit 124 .

The asset relationship graph generation unit 122 determines reachability by inquiring the network topology and access control list information included in the network information, and configures a reachability group based on the reachability to form a correlation relationship with the asset information. to set

Specifically, the asset relationship graph generating unit 122 calculates a reachability matrix for reachability with other assets except for the predetermined asset by inquiring the network topology and access control list information for the predetermined asset. The asset relationship graph generating unit 122 may configure the assets having the same reachability in the reachability matrix into reachability groups, and may generate the asset relationship graph by using the relationship to the reachability group.

In addition, the asset relationship graph generating unit 122 creates an asset relationship graph by setting a correlation relationship between the service information and the vulnerability of the asset based on the vulnerability information and the application information of the asset.

The asset relationship graph generation unit 122 may determine whether an asset is accessible based on the owner account information and authentication information included in the application information, and may set a correlation for the asset information according to whether the asset is accessible.

On the other hand, the asset relationship graph generating unit 122 may set the correlation for the asset information according to the state change condition of at least one of conditions such as denial of service, information acquisition, remote command execution, and privilege elevation, which are causes of weakness of the asset. have.

When information on at least one asset among a plurality of assets is changed, the asset relationship graph update unit 124 updates the asset relationship graph based on the changed asset information. In addition, the asset relationship graph update unit 124 may update the asset relationship graph by inquiring the changed network topology and access control list information of the corresponding asset whenever asset information is changed. In addition, the asset relationship graph update unit 124 inquires the added or changed asset information, routing information, firewall policy, etc. added or changed for a predetermined asset, and considers the network topology, routing information, firewall policy, etc. with respect to the changed asset A reachability matrix may be calculated by calculating whether it is possible to communicate with the remaining assets except for a predetermined asset. In addition, the asset relationship graph updating unit 124 may reconfigure assets having the same reachability into reachability groups in the reachability matrix, and may update the asset relationship graph using the relationship to the reachability group. Also, the asset relationship graph update unit 124 may update the asset relationship graph by collecting vulnerability information of the corresponding asset and service information being used whenever asset information is changed. In addition, the asset relationship graph update unit 124 inquires the added or changed asset information, application information, vulnerability check result, etc. added or changed for a predetermined asset, and a state change in which the asset and the vulnerability possessed by each asset may be caused by the corresponding vulnerability. In other words, it can be grouped based on denial of service, information acquisition, remote command execution, privilege elevation, etc. In addition, the asset relationship graph updater 124 may group the application services owned by each asset based on whether access to the main shell of the asset is possible through authentication information (eg, credential). In addition, the asset relationship graph update unit 124 may update the asset relationship graph by resetting the correlation between the asset and the vulnerability (instance of the vulnerability) possessed by the asset.

The attack graph generating unit 130 determines reachability and vulnerability based on the asset relationship graph, and generates an attack graph using the reachability and vulnerability. Specifically, the attack graph generating unit 130 may identify an attack candidate target based on reachability and vulnerability, and may generate an attack graph by searching the asset relationship graph based on whether the attack candidate target is accessible. .

The attack graph generating unit 130 generates an attack graph by selecting one attack candidate target and searching the asset relationship graph according to the attack graph generation condition based on the attack candidate target. Here, the attack graph generation condition may be information input from an external device or a user, and may include actual cyber attack situation information or defense policy application situation information.

The attack target analysis unit 140 searches an attack path based on the generated attack graph and performs an operation of predicting an attack target based on the attack path. The attack target analysis unit 140 according to the present embodiment may include an attack graph search unit 142 , an attack path prediction unit 144 , and an attack target risk analysis unit 146 .

The attack graph search unit 142 searches for at least one attack path based on the generated attack graph.

The attack path prediction unit 144 determines a final attack path among at least one attack path searched by the attack graph search unit 142 and predicts an attack target in the final attack path. In addition, when a plurality of attack paths are detected, the attack path prediction unit 144 may determine the final attack path in consideration of reachability for each path, a vulnerability state, a firewall policy level, and the like. In addition, the attack path prediction unit 144 may predict an attack target in the final attack path based on the vulnerability of the attack graph and the running application. In addition, the attack path prediction unit 144 additionally performs a vulnerability check solution as well as known vulnerabilities and attribute information on the attack path, and uses the actual vulnerability check result by the vulnerability check solution to improve the prediction accuracy of the attack target. can In addition, the attack path prediction unit 144 can predict the attack target by extracting application information of the asset included in the attack path and additionally checking whether it is possible to obtain the application and system authority for executing the vulnerability. It is possible to predict the asset characteristics that will be affected by the threat of an attack. In addition, the attack path prediction unit 144 may provide information on the predicted attack target to an external device or a user. Here, the attack path prediction unit 144 may provide information about a vulnerability to an attack target and an application running in the vulnerability together.

The attack target risk analysis unit 146 may calculate the predicted asset risk level of the attack target. In addition, the attack target risk analysis unit 146 may evaluate the attack target's asset risk by using the attack graph-based AssetRank algorithm. The attack target risk analysis unit 146 may calculate the asset risk using [Equation 1].

(X: risk, D: adjacency matrix, ΓPe ^T : potential for development, X ₀ : initial value)

2 is a flowchart illustrating an attack target prediction method based on an attack graph according to an embodiment of the present invention.

The attack target prediction apparatus 100 extracts asset information including asset vulnerability information, network information, and application information ( S210 ).

The attack target prediction device 100 sets the correlation between the extracted asset information and stores the asset relationship graph ( S220 ).

The attack target prediction device 100 determines the reachability by inquiring the network topology and access control list information included in the network information, configures a reachability group based on the reachability, and establishes a correlation for the asset information, Based on the asset's vulnerability information and application information, the relationship between the asset's service information and the vulnerability is established to create an asset relationship graph.

The attack target prediction apparatus 100 generates an attack graph by calculating reachability and vulnerability based on the correlation of the asset relationship graph (S230, S240). For example, the attack target prediction apparatus 100 may generate an attack graph by identifying an attack candidate target based on reachability and vulnerability, and searching an asset relationship graph based on whether the attack candidate target is accessible.

When there is an attack target analysis request from an external device or a user (S250), the attack target prediction apparatus 100 searches for at least one attack path in the attack graph (S260).

The attack target prediction apparatus 100 predicts an attack target on at least one attack path ( S270 ). For example, when a plurality of attack paths are detected, the attack target prediction apparatus 100 may determine the final attack path in consideration of reachability for each path, vulnerability status, firewall policy level, and the like.

Although it is described that each step is sequentially executed in FIG. 2 , the present invention is not limited thereto. In other words, since it may be applicable to changing and executing the steps described in FIG. 2 or executing one or more steps in parallel, FIG. 2 is not limited to a time-series order.

The attack target prediction method according to the present embodiment described in FIG. 2 may be implemented as an application (or program) and recorded in a recording medium readable by a terminal device (or computer). The recording medium in which the application (or program) for implementing the attack target prediction method according to the present embodiment is recorded and the terminal device (or computer) can read is any type of recording device in which data that can be read by the computing system is stored. or media.

3 is a flowchart illustrating an operation of predicting an attack target and analyzing the risk of an attack target in the attack target prediction apparatus according to an embodiment of the present invention.

When an algorithm is executed to predict an attack target among a plurality of assets, the attack target prediction apparatus 100 checks the type of analysis basis (S310).

As a result of checking in step S310, when predicting an attack target based on the attack graph, the attack target prediction apparatus 100 receives an attack graph generation condition through a condition input screen (S320). Here, the attack graph generation condition may be information input from an external device or a user, and may include actual cyber attack situation information or defense policy application situation information.

The attack target prediction apparatus 100 generates an attack graph in consideration of actual cyber attack situation information or defense policy application situation information (S330, S340) (S350). Here, the attack graph may determine reachability and vulnerability based on the learned asset relationship graph using vulnerability information, network information, and application information, and may generate an attack graph using the reachability and vulnerability.

On the other hand, as a result of checking in step S310, when the attack target prediction device 100 predicts an attack target based on the asset characteristic, it receives an asset characteristic from an external device or user (S312), identifies an asset vulnerable to an attack, and attacks An attack target is predicted by identifying the same characteristic asset having the same characteristic as the vulnerable characteristic (S314).

The attack target prediction device 100 performs an asset risk assessment for an attack target predicted based on an attack graph or asset characteristics (S360), and stores and manages the evaluation result for the performance (S370).

Although it is described that each step is sequentially executed in FIG. 3 , it is not necessarily limited thereto. In other words, since it may be applicable to changing and executing the steps described in FIG. 3 or executing one or more steps in parallel, FIG. 3 is not limited to a time-series order.

4 is a diagram for explaining an operation of processing an asset relationship graph based on network information according to an embodiment of the present invention.

Referring to the sample network shown in (a) of FIG. 4 , the attack target prediction device 100 inquires the changed network topology and access control list information of the corresponding asset whenever asset information is changed, and the asset relationship graph update

Referring to FIG. 4 (b), the attack target prediction device 100 inquires additionally changed asset information, routing information, firewall policy, etc. added or changed for a predetermined asset, and network topology and routing information for the changed asset. , and a firewall policy, and the like, calculate whether it is possible to communicate with the remaining assets except for a predetermined asset to calculate a reachability matrix.

Referring to (c) and (d) of Figure 4, the attack target prediction apparatus 100 reconfigures the assets having the same reachability in the reachability matrix into a reachability group, and the relationship to the reachability group to update the Asset Relation Graph.

5 is a diagram for explaining an operation of processing an asset relationship graph based on network information for vulnerability information and application information according to an embodiment of the present invention.

The attack target prediction apparatus 100 may classify the vulnerabilities possessed by each asset based on whether the asset can be seized.

Referring to the first classification group 510 of FIG. 5 , when a vulnerability related to denial of service and information acquisition exists in asset A, asset A cannot acquire access rights and cannot proceed to the next asset. In addition, if there is a vulnerability related to remote command execution in asset A, asset A gains access and can proceed to the next asset. In addition, if there is a vulnerability related to the elevation of privilege in asset A, the next asset cannot proceed, but the privilege to asset A may be elevated.

The attack target prediction device 100 may classify applications owned by each asset based on whether logging into the corresponding asset is possible.

Referring to the second classification group 520 of FIG. 5 , for asset D, whether to proceed with the next asset movement may be determined according to the access right information of the holding application. Here, asset D can check access right information in consideration of the account owned by the application.

The attack target prediction apparatus 100 may update the asset relationship graph by collecting vulnerability information of the corresponding asset and service information being used whenever asset information is changed.

In addition, the attack target prediction device 100 inquires the additional or changed asset information, application information, vulnerability check result, etc. added or changed for a predetermined asset, and changes the state that the asset and the vulnerability possessed by the asset can cause the corresponding vulnerability, that is, They are grouped according to service denial, information acquisition, remote command execution, and privilege escalation. In addition, the attack target prediction apparatus 100 may group the application services possessed by each asset based on whether access to the main shell of the asset is possible through authentication information (eg, credential).

In addition, the attack target prediction apparatus 100 may update the asset relationship graph by resetting the relationship between the asset and the vulnerability (an instance of the vulnerability) possessed by the asset.

6 is a view for explaining an operation of generating an attack graph and predicting an attack target and a path in the attack target prediction apparatus according to an embodiment of the present invention.

6A is an exemplary diagram illustrating an operation of determining reachability and vulnerability based on an asset relationship graph, and searching an attack graph using reachability and vulnerability. Also, FIG. 6B is an exemplary diagram illustrating an attack graph generated based on a search result of the attack graph.

As shown in (a) of FIG. 6 , it can be confirmed that the transit node must have Vul_root or App_shell in order to proceed to the next reachability group in the asset relationship graph.

As shown in (b) of FIG. 6 , the attack target prediction apparatus 100 uses the first attack path (B→C→E) and the second attack path (B→D→E) through the attack graph of the search result. can be predicted

The attack target prediction apparatus 100 may store a snapshot of the analysis condition and the result attack graph. The attack target prediction apparatus 100 may separate and store each node-edge-node so that the same attack graph can be reproduced in the future through the stored snapshot.

7 is a diagram illustrating an analysis result of an attack target risk of an attack target prediction apparatus according to an embodiment of the present invention.

Referring to FIG. 7 , the attack target prediction apparatus 100 may evaluate the attack target's asset risk by using the attack graph-based AssetRank algorithm.

Figure 7 (a) shows an asset dependence graph, Figure 7 (b) shows an asset rank (AssetRank) for the asset dependence graph. Through (a) and (b) of FIG. 7 , the attack target prediction device 100 can quantitatively present the risk and expected damage of the attack target asset, and can evaluate the risk by using the attack graph-based AssetRank algorithm. .

8 is a diagram for explaining a comparison between an attack target prediction method based on an attack graph according to an embodiment of the present invention and a conventional attack target prediction method.

Fig. 8(a) shows the database structure (relational DB) of the conventional attack graph generating method, and Fig. 8(b) shows the database structure (graph DB) of the attack graph generating method according to the present embodiment.

The database structure of the conventional attack graph generation method has the following characteristics.

- Data type: fixed, predefined table

- Query performance: Fast and stable when there are few JOINs / Data processing performance deteriorates as the JOIN depth increases

- Data expression: only table type display / Difficult to express real life visually

The attack graph generation method according to the present embodiment has the following characteristics.

- Data type: Connected data (Graph DB is suitable for storing data that are linked to each other due to the reachability and vulnerability of assets)

- Query performance: guarantees zero latency and real-time performance regardless of the number of depths of relationships (there should not be a limit to the depth of search due to the nature of the attack graph to discover all infiltible assets from the attacker's location)

- Data representation: suitable for modeling and visualization of real life (Graph DB is suitable for expressing relationships between assets constituting an attack graph close to topology)

As a result of comparing the conventional attack graph generation method and the attack graph generation method according to the present embodiment based on the above-mentioned contents, like the attack graph, the relationship between nodes is complicated and the graph search depth is relatively small. It is efficient to predict the target of attack to configure it to search the path. These comparisons are shown in [Table 2]. (In [Table 2], RDBS: conventional attack graph generation method, Neo4j: attack graph generation method according to this embodiment)

As described so far, according to an embodiment of the present invention, by additionally considering information on applications executable in an asset to network information and vulnerability information, prediction accuracy of an attack target using an attack graph is improved.

In addition, by utilizing a graph DB for collecting and expressing large-scale context information for vulnerability, network and application information, the accuracy of predicting an attack target using the attack graph is further improved.

In addition, damage to network assets on the attack path can be prevented by predicting an attack target in consideration of weaknesses and access rights of assets through vulnerabilities, network configuration information, and application information in the attack path.

Combinations of each block in the block diagram attached to the present invention and each step in the flowchart may be performed by computer program instructions. These computer program instructions may be embodied in a processor of a general-purpose computer, special-purpose computer, or other programmable data processing equipment, such that the instructions executed by the processor of the computer or other programmable data processing equipment may be configured in the respective blocks in the block diagram or in the flowchart. Each step creates a means for performing the described functions. These computer program instructions may also be stored in a computer-usable or computer-readable medium that may direct a computer or other programmable data processing equipment to implement a function in a particular manner, and thus the computer-usable or computer-readable medium. The instructions stored in the recording medium can also produce an item of manufacture including instruction means for performing functions described in each block in the block diagram or in each step in the flowchart. The computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operational steps are performed on the computer or other programmable data processing equipment to create a computer-executed process to create a computer or other programmable data processing equipment. It is also possible that instructions for performing the processing equipment provide steps for carrying out the functions described in each block of the block diagram and each step of the flowchart.

Further, each block or each step may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function(s). It should also be noted that in some alternative embodiments it is also possible for the functions recited in blocks or steps to occur out of order. For example, it is possible that two blocks or steps shown one after another may in fact be performed substantially simultaneously, or that the blocks or steps may sometimes be performed in the reverse order according to the corresponding function.

The above description is merely illustrative of the technical spirit of the present invention, and various modifications and variations will be possible without departing from the essential characteristics of the present invention by those skilled in the art to which the present invention pertains. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical spirit of the present invention, but to explain, and the scope of the technical spirit of the present invention is not limited by these embodiments. The protection scope of the present invention should be construed by the following claims, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

100: attack target prediction device
110: information extraction unit 120: data relationship setting unit
130: attack graph generation unit 140: attack target analysis unit

Claims (14)

Vulnerability information (including asset public vulnerability information and vulnerability check result information), network information (including network topology and access control list information of the asset), and application information (including application service information executable on the asset, owner account information and an information extraction unit for extracting asset information including authentication information;
a data relationship setting unit for setting a relationship with respect to the asset information and generating an asset relationship graph based on the relationship;
After determining the reachability and vulnerability determined based on the asset information and the relationship based on the asset relationship graph, an attack candidate target is identified based on the determined reachability and the vulnerability, and the attack candidate target can be accessed an attack graph generating unit that searches the asset relationship graph based on whether or not and generates an attack graph; and
An attack target analysis unit for predicting an attack target based on the attack path searched based on the attack graph,
The attack graph generating unit generates the attack graph by learning the asset relationship graph in advance, and searching a path based on the asset relationship graph immediately at a time point given a condition for attack target prediction,
The data relationship setting unit,
An asset having the same reachability in the reachability matrix is calculated by inquiring the network topology and the access control list information for a given asset to calculate a reachability matrix for reachability with the remaining assets except for the prescribed asset an asset relationship graph generating unit that configures the groups into reachability groups to establish a relationship with respect to the asset information, and generates the asset relationship graph using the relationship for the reachability group;
When the information of at least one of the assets is changed, the asset relationship graph is updated based on the changed asset information, and application services owned by each asset are grouped based on whether a specific shell of the asset can be accessed through the authentication information. and an asset relationship graph update unit configured to update the asset relationship graph by resetting the relationship between the asset and the vulnerability possessed by the asset.
Attack target prediction device. delete delete delete delete The method of claim 1,
The data relationship setting unit generates the asset relationship graph by setting a correlation between the service information and the vulnerability of the asset based on the vulnerability information and the application information of the asset.
Attack target prediction device. 7. The method of claim 6,
The data relationship setting unit is configured to establish a relationship for the asset information according to a state change condition of at least one of denial of service, information acquisition, remote command execution, and privilege elevation, which are causes of weakness of the asset
Attack target prediction device. 7. The method of claim 6,
The data relationship setting unit determines whether an asset is accessible based on the owner account information and authentication information included in the application information, and sets a correlation for the asset information according to the accessibility
Attack target prediction device. The method of claim 1,
The attack graph generating unit identifies an attack candidate target based on the reachability and the vulnerability, and generates the attack graph by searching the asset relationship graph based on whether the attack candidate target is accessible
Attack target prediction device. 10. The method of claim 9,
The attack target analysis unit predicts the attack target by searching the attack path based on the vulnerability of the attack graph and the running application, and provides information about the vulnerability to the attack target and the application running in the vulnerability.
Attack target prediction device. As an attack target prediction method of an attack target prediction device,
Vulnerability information (including asset public vulnerability information and vulnerability check result information), network information (including network topology and access control list information of the asset), and application information (including application service information executable on the asset, owner account information and information extraction step of extracting asset information including (including authentication information);
a data relationship setting step of setting a relationship for the asset information and generating an asset relationship graph based on the relationship;
After determining the reachability and vulnerability determined based on the asset information and the relationship based on the asset relationship graph, an attack candidate target is identified based on the determined reachability and the vulnerability, and the attack candidate target can be accessed an attack graph generating step of generating an attack graph by searching the asset relationship graph based on whether or not; and
An attack target analysis step of predicting an attack target based on the attack path searched based on the attack graph,
In the step of generating the attack graph, the asset relationship graph is learned in advance, and the attack graph is generated by searching a path based on the asset relationship graph immediately at a time point given the conditions for attack target prediction,
The data relationship setting step is,
An asset having the same reachability in the reachability matrix is calculated by inquiring the network topology and the access control list information for a given asset to calculate a reachability matrix for reachability with the remaining assets except for the prescribed asset establishing a relationship for the asset information by configuring them into reachability groups, and generating the asset relationship graph using the relationship for the reachability group;
When the information of at least one of the assets is changed, the asset relationship graph is updated based on the changed asset information, and application services owned by each asset are grouped based on whether a specific shell of the asset can be accessed through the authentication information. and updating the asset relationship graph by resetting the correlation between the asset and the vulnerability possessed by the asset.
How to predict an attack target. delete delete delete

Images